Configure the Ubuntu security pocket

Description

The Ubuntu Security Team publishes fixes in the <codename>-security pocket (for example noble-security), served from security.ubuntu.com/ubuntu (ports.ubuntu.com/ubuntu-ports for other architectures). Each Ubuntu release needs an enabled deb entry for this pocket, or for an internal mirror of it.

On a system attached to Ubuntu Pro, the Expanded Security Maintenance (ESM) fixes for the main and restricted components are published in the <codename>-infra-security pocket of esm.ubuntu.com/infra/ubuntu, which the Pro client adds when the esm-infra service is enabled. Attached systems must have it too.

Configured by default on every release (security.ubuntu.com in /etc/apt/sources.list on 20.04 and 22.04, in /etc/apt/sources.list.d/ubuntu.sources on 24.04 and later). The ESM check only applies to systems attached to Ubuntu Pro (fact ubuntu-pro); whether a system should be attached is decided by CB-UBU-PKG-009 and CB-UBU-PKG-014. The esm-apps pocket is checked by CB-UBU-PKG-014.

Rationale

Fixes reach the <codename>-updates pocket too, but only the security pocket is guaranteed to carry every security fix as soon as it is published, and it is the one unattended-upgrades installs from. Without it, a system stays exposed to every published vulnerability, even if updates are applied every day. Once a release leaves standard support (20.04 since May 2025), new fixes for main and restricted are published in ESM only.

Impact

None known. The system must reach the security mirror (and esm.ubuntu.com when attached to Ubuntu Pro) or an internal copy of them.

Setting

Audit

1. Run apt-cache policy | grep -- '-security'. It must list the <codename>-security pocket of the installed release (. /etc/os-release; echo "$VERSION_CODENAME").
2. If pro status shows the system attached to Ubuntu Pro, it must also list <codename>-infra-security from esm.ubuntu.com, and pro status must show esm-infra enabled.

Automated: every check must pass. Scanners report each check by its id.

security-suite

Enabled deb entries for the security pocket of the installed release.

script: |
  c=$( (. /etc/os-release && printf '%s' "${VERSION_CODENAME:-}") 2>/dev/null)
  [ -n "$c" ] || { echo "VERSION_CODENAME unknown in /etc/os-release"; exit 3; }
  files=
  for f in /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources; do
    [ -f "$f" ] && files="$files $f"
  done
  [ -n "$files" ] || { echo "no APT source file"; exit 1; }
  # One line per entry: file:line, types, URIs, suites, ;option=value list (lowercase).
  # shellcheck disable=SC2086
  awk '
    function flush() { if (st && en != "no") print src "\t" ty "\t" ur "\t" su "\t" op; st = 0; ty = ur = su = op = en = "" }
    FNR == 1 { flush(); d = FILENAME ~ /\.sources$/ }
    !d {
      sub(/#.*/, ""); if ($1 !~ /^deb(-src)?$/) next
      l = $0; o = ""; i = index(l, "["); j = index(l, "]")
      if (i && j > i) { o = substr(l, i + 1, j - i - 1); l = substr(l, 1, i - 1) " " substr(l, j + 1) }
      split(l, w, " "); gsub(/[ \t]+/, ";", o)
      print FILENAME ":" FNR "\t" w[1] "\t" w[2] "\t" w[3] "\t;" tolower(o); next
    }
    /^#/ { next }
    /^[ \t]*$/ { flush(); next }
    /^[ \t]/ { next }
    {
      if (!st) { st = 1; src = FILENAME ":" FNR }
      k = $0; sub(/:.*/, "", k); k = tolower(k); v = $0; sub(/^[^:]*:[ \t]*/, "", v)
      if (k == "types") ty = v; else if (k == "uris") ur = v; else if (k == "suites") su = v
      else if (k == "enabled") en = tolower(v)
      else op = op ";" k "=" tolower(v == "" ? "inline" : v)
    }
    END { flush() }' $files | awk -F '\t' -v s="$c-security" '
    {
      nt = split($2, t, " "); ns = split($4, w, " "); deb = 0
      for (i = 1; i <= nt; i++) if (t[i] == "deb") deb = 1
      for (i = 1; i <= ns; i++) if (deb && w[i] == s) { print $1 " " $3 " " s; found = 1 }
    }
    END { if (!found) print "no enabled deb entry for " s; exit !found }'

esm-infra-suite

Enabled deb entries for the ESM infra pocket, on systems attached to Ubuntu Pro.

script: |
  c=$( (. /etc/os-release && printf '%s' "${VERSION_CODENAME:-}") 2>/dev/null)
  [ -n "$c" ] || { echo "VERSION_CODENAME unknown in /etc/os-release"; exit 3; }
  files=
  for f in /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources; do
    [ -f "$f" ] && files="$files $f"
  done
  [ -n "$files" ] || { echo "no APT source file"; exit 1; }
  # One line per entry: file:line, types, URIs, suites, ;option=value list (lowercase).
  # shellcheck disable=SC2086
  awk '
    function flush() { if (st && en != "no") print src "\t" ty "\t" ur "\t" su "\t" op; st = 0; ty = ur = su = op = en = "" }
    FNR == 1 { flush(); d = FILENAME ~ /\.sources$/ }
    !d {
      sub(/#.*/, ""); if ($1 !~ /^deb(-src)?$/) next
      l = $0; o = ""; i = index(l, "["); j = index(l, "]")
      if (i && j > i) { o = substr(l, i + 1, j - i - 1); l = substr(l, 1, i - 1) " " substr(l, j + 1) }
      split(l, w, " "); gsub(/[ \t]+/, ";", o)
      print FILENAME ":" FNR "\t" w[1] "\t" w[2] "\t" w[3] "\t;" tolower(o); next
    }
    /^#/ { next }
    /^[ \t]*$/ { flush(); next }
    /^[ \t]/ { next }
    {
      if (!st) { st = 1; src = FILENAME ":" FNR }
      k = $0; sub(/:.*/, "", k); k = tolower(k); v = $0; sub(/^[^:]*:[ \t]*/, "", v)
      if (k == "types") ty = v; else if (k == "uris") ur = v; else if (k == "suites") su = v
      else if (k == "enabled") en = tolower(v)
      else op = op ";" k "=" tolower(v == "" ? "inline" : v)
    }
    END { flush() }' $files | awk -F '\t' -v s="$c-infra-security" '
    {
      nt = split($2, t, " "); ns = split($4, w, " "); deb = 0
      for (i = 1; i <= nt; i++) if (t[i] == "deb") deb = 1
      for (i = 1; i <= ns; i++) if (deb && w[i] == s) { print $1 " " $3 " " s; found = 1 }
    }
    END { if (!found) print "no enabled deb entry for " s; exit !found }'

Remediation

1. Add the security pocket, for example in /etc/apt/sources.list.d/ubuntu.sources on 24.04 and later (replace noble with the codename of the installed release, or the URI with an internal mirror):

   Types: deb
   URIs: https://security.ubuntu.com/ubuntu
   Suites: noble-security
   Components: main universe restricted multiverse
   Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
   

   On 20.04 and 22.04, add to /etc/apt/sources.list: deb [signed-by=/usr/share/keyrings/ubuntu-archive-keyring.gpg] https://security.ubuntu.com/ubuntu jammy-security main restricted universe multiverse.

2. On a system attached to Ubuntu Pro, run pro enable esm-infra: the Pro client writes the ESM source entry and its key.

3. Run apt-get update.

References

• Ubuntu Server documentation - Package management Canonical, vendor-doc, accessed 2026-10-19
• Ubuntu Pro Client - How to enable ESM Infra Canonical, vendor-doc, accessed 2026-10-19
• Ubuntu - Expanded Security Maintenance Canonical, vendor-doc, accessed 2026-10-19
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R61) ANSSI, guide, accessed 2026-10-19

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-UBU-PKG-007 Install security updates automatically
• related CB-UBU-PKG-008 Leave no security update pending
• related CB-UBU-PKG-009 Run an Ubuntu release that still receives security updates

People and lifecycle